NGC Build — how we collect, use and protect your information.
NGC Build App
Last updated: 11 October 2026
Nick Gradica Contracts Ltd operates NGC Build App. This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, use the app, connect an email account, access a client portal or contact us.
It also explains your rights and how to exercise them.
The operator of NGC Build App is:
Nick Gradica Contracts Ltd
94 Havering Gardens
Romford
RM6 5AB
United Kingdom
Privacy contact: info@ngcbuild.co.uk
Privacy Policy: https://www.ngcbuild.app/privacy
In this policy, “we”, “us” and “our” mean Nick Gradica Contracts Ltd.
We act as a data controller for personal information we use to administer app accounts, manage subscriptions, provide support, protect the service, meet our legal obligations and conduct our own marketing.
When a business uses the app to manage information about its clients, employees, subcontractors, suppliers, projects or correspondence, that business normally acts as the data controller. We act as its data processor, handling that information on its instructions and under the applicable data processing agreement.
If you use the app through your employer or another business, or access a client portal provided by a construction company, that business’s privacy notice also applies. It is responsible for its decisions about the information it uploads, the people it shares information with and how long its project records should be retained.
Account administration does not automatically authorise every user to access another user’s mailbox. Access to records depends on the applicable workspace permissions, email connection and sharing settings.
Depending on the features you use, we collect the following categories of information.
Your name, email address, telephone number, organisation, role, account identifiers, access permissions, preferences and settings.
Information entered or uploaded by users, including client and supplier details, property addresses, quotations, contracts, drawings, specifications, programmes, purchase orders, invoices, valuations, change orders, tasks, RFIs, photographs, documents, comments and completion records.
These records may contain personal information about homeowners, employees, subcontractors, suppliers and other project participants.
When you authorise a Gmail or Outlook connection, the app may access your email address, account identifiers, sender and recipient details, subjects, message bodies, threads, timestamps, folders or labels, drafts and attachments, within the permissions you grant.
We also handle the authorisation tokens needed to maintain the connection. You authorise access through Google or Microsoft; we do not ask you to provide your Gmail or Outlook password.
Billing contact details, billing addresses, subscription plans, invoices, transaction references and payment status. Payment providers process payment information according to their own privacy notices.
Information such as IP address, browser and device type, operating system, access times, features used, error reports, connection status and security logs.
Enquiries, feedback, support correspondence and information you provide when asking us to investigate a problem.
Please avoid uploading sensitive personal information unless it is necessary for a legitimate purpose. Information about health, accessibility, criminal offences or other sensitive matters requires additional legal safeguards. Customer businesses are responsible for establishing the necessary legal conditions before uploading this information.
We collect information:
Where we obtain information indirectly and act as controller, we provide the required privacy information within the applicable legal timeframe, unless a lawful exception applies.
We use personal information to:
We do not use connected mailbox contents to target advertising.
For processing where we act as controller, we rely on the appropriate lawful basis under applicable data protection law.
Contract: where processing is necessary to provide a service under a contract with you, or to take steps you request before entering a contract.
Legitimate interests: where processing is necessary to administer business customer relationships, provide support, maintain security, improve reliability or protect our legal rights. We consider the impact on individuals and balance these interests against their rights.
Where our contract is with your organisation rather than you personally, legitimate interests will normally apply to necessary business contact processing.
Legal obligation: where processing is required by applicable law, including relevant accounting, tax and regulatory duties.
Consent: where required for activities such as certain marketing communications or optional tracking technologies. You can withdraw consent without affecting the lawfulness of processing before withdrawal.
Authorising a Google or Microsoft connection permits access to that service. It does not automatically make consent the legal basis for every subsequent use of the information.
For customer-controlled project content, the customer determines the lawful basis and we process the information on its instructions.
Connecting a Google account is optional. Google’s authorisation screen identifies the permissions requested. Signing in with Google does not, by itself, authorise access to Gmail.
Depending on the permissions granted and features enabled, NGC Build App uses Gmail information to display and search messages, handle attachments and drafts, send messages, organise labels, link correspondence to projects and provide AI assistance.
Synchronisation and configured automations may process authorised information in the background. Users should review the features they enable and the permissions displayed when connecting.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace user data and developer policy, including their Limited Use requirements.
Google data is not sold, used for advertising, transferred to data brokers or used to train general-purpose or non-personalised AI models.
Transfers are limited to permitted purposes, including consented user-facing features, security, legal compliance and business transactions with the required prior consent.
Human access is limited to Google’s permitted exceptions, including explicit agreement to access specific information, security investigations, legal requirements and permitted aggregated, anonymised internal operations.
You can revoke Google access at:
https://myaccount.google.com/connections
Revoking access stops future authorised access. It does not automatically delete copies already imported into app records or sent to recipients. To request deletion of information held by us, contact nick@ngcbuild.co.uk.
Connecting Outlook or Microsoft 365 is optional and uses Microsoft’s authorisation process.
Within the permissions you grant, the app may display and manage messages, folders, drafts and attachments, send communications, link correspondence to project records and provide AI assistance.
Your organisation’s Microsoft administrator may restrict or manage the permissions available to you.
You can revoke access through Microsoft’s account permission controls or your organisation’s administrator. You can also contact us for assistance disconnecting the app.
Revoking access does not automatically delete previously imported project records or copies held by message recipients.
NGC Build App uses AI to assist with activities such as summarising emails, drafting replies, extracting information from attachments, organising project information and preparing suggested tasks or business records.
AI features can read and process email contents and attachments from connected accounts. Depending on the feature, this may include correspondence, contact details, invoice information, project documents, prompts and generated results.
Relevant information may be transmitted to AI service providers supporting the app. We limit processing to the information needed for the disclosed feature and require appropriate protection from providers handling it on our behalf.
Google-derived information remains subject to the restrictions in section 7, including the prohibition on training general-purpose or non-personalised models.
AI processing may take place when a user requests assistance or when an authorised automation is enabled. The app must explain the relevant access and processing before the feature is activated.
AI outputs can be inaccurate. Users should check generated replies, extracted figures and suggested records before relying on them.
If a feature involves solely automated decisions with legal or similarly significant effects on an individual, we will provide the required information about that processing and applicable safeguards, including ways to contest the decision and obtain human intervention.
We share personal information only where necessary for a disclosed purpose and permitted by applicable law.
Recipients may include:
Providers acting as processors must handle information under appropriate contractual instructions and safeguards. Some providers also act as independent controllers for their own services.
Sending an email, exporting a document or sharing a project record discloses information to its recipients. Customer organisations are responsible for choosing appropriate recipients and managing their workspace permissions.
We do not sell personal information.
In a merger, acquisition or sale, relevant information may be transferred subject to applicable safeguards. Google information remains subject to its additional transfer and consent requirements.
You can request information about providers handling your personal information by contacting nick@ngcbuild.co.uk.
Our platform and service providers may store or access personal information outside the United Kingdom.
Where this constitutes a restricted international transfer, we use the applicable lawful transfer mechanism. This may include an adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses.
Where required, we assess the protection available in the destination country and implement supplementary safeguards.
Contact nick@ngcbuild.co.uk to request information about relevant processing locations or a copy of applicable transfer safeguards. Confidential commercial information may be redacted.
We retain personal information only for as long as necessary for its stated purpose.
We determine retention by considering:
Customer-controlled project records are retained according to the customer’s instructions and service arrangements.
Email information imported into project records may remain after an email connection is revoked. Disconnecting an integration and deleting previously imported content are separate actions.
Authorisation credentials are retained only while needed to support a connection or complete its secure removal. AI inputs and outputs are subject to the retention arrangements applicable to the feature and its service providers.
On account closure or a valid deletion request, we delete or return information where required. We may retain limited records where necessary for legal obligations, claims, security or respecting marketing opt-outs.
Deleted information may remain in restricted backups until their scheduled expiry. Information already sent to recipients is subject to their own retention practices.
Contact nick@ngcbuild.co.uk to request deletion or information about the retention rules applicable to your records.
We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration and disclosure.
Access should be limited to authorised users and service providers who need the information for their role. We review security measures according to the nature of the information and the risks involved.
No online service can guarantee complete security. Users should protect their credentials, use available account security features and check access permissions before sharing information.
Report suspected unauthorised access or a privacy incident to nick@ngcbuild.co.uk.
Where a personal data breach requires notification, we notify the relevant customer, regulator or affected individuals in accordance with applicable legal requirements.
The website and app may use cookies, browser storage and similar technologies to support sign-in, security, preferences and service operation.
Where optional analytics or other tracking requires consent, it must remain disabled until that consent is obtained. Any reliance on a statutory exception must meet its applicable conditions, including required information and objection controls.
Information about optional technologies and available choices is provided when those technologies are offered.
You can also manage cookies through your browser settings. Blocking technologies necessary for sign-in or security may prevent parts of the app from working.
We may send information about the app and related services where permitted by law.
Where consent is required, we obtain it before sending marketing. Where a lawful exception applies, we provide the required opportunity to opt out.
You can stop marketing by using an unsubscribe link or contacting nick@ngcbuild.co.uk. We may retain a minimal suppression record to respect your preference.
Essential account, billing, security and service messages may continue because they are necessary to administer the service.
Customer businesses using the app for their own marketing are responsible for their messages, lawful bases, recipient permissions and opt-out arrangements.
Depending on the circumstances and applicable law, you may have the right to:
Your right to object: You may object to processing based on legitimate interests on grounds relating to your situation. We will stop unless an applicable legal justification permits continued processing.
You can object to direct marketing at any time, including profiling related to that marketing.
To exercise your rights, contact info@ngcbuild.co.uk. We may request proportionate information to verify your identity or authority.
We normally respond without undue delay and within one month, subject to applicable clarification, extension and exception rules. Requests are generally free. Where a lawful extension or refusal applies, we explain the reason and your complaint options.
For information controlled by a customer organisation, that organisation is responsible for responding. We assist it where required.
Some information is necessary to create an account, authenticate access, administer a subscription or provide a requested feature. If you do not provide it, the relevant service may be unavailable.
Email connections and related AI features are optional. Declining access prevents those features from operating.
NGC Build App is intended for business users and authorised project participants. It is not designed as a service for children. Please contact us if you believe a child has provided information inappropriately.
Contact nick@ngcbuild.co.uk if you have a concern about how personal information is handled.
We acknowledge data protection complaints within 30 days, investigate without undue delay and explain the outcome and any corrective action.
You also have the right to complain to the UK Information Commissioner’s Office:
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Where another jurisdiction’s data protection law applies, you may also have rights to complain to its relevant supervisory authority.
We may update this policy when the app, our processing practices or applicable requirements change.
The latest version is available at https://www.ngcbuild.app/privacy. We notify users of material changes through appropriate channels and provide additional information or obtain fresh consent where required before introducing new processing.